I think people should be able to disable permissions.
Who knows. Could the app be programmed to do that and send them to a server . Someone reading a pdf could make a note of a phone number and minimise the pdf and make the call.
One app i tired had access to photos files as permissions etc but...